amicus 4.6.2 → 4.7.0

package/src/council/run-stages.js

@@ -23,91 +23,13 @@ const { materializeReviews, isAbortExit } = require('./run-launch');
 const { retryStage1Losses } = require('./run-retry');
 const runState = require('./run-state');
 const { runStage2 } = require('./run-stage2');
+const { launchStage1 } = require('./run-stage1-launch');
+const { buildRunStatsEntry } = require('./run-assemble');
 
 function slug(text) {
   return String(text).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
 }
 
-/** Launch all Stage-1 legs (wave + critic/lens solos), collect run docs. */
-async function launchStage1(ctx) {
-  const { o, launchers } = ctx;
-  // `noCostGate` rides EVERY launch object in this file (here, the findings
-  // repair, the judge wave, the judge repair) — see run-launch.js's fanout call.
-  const common = {
-    project: o.runDir, timeout: o.timeout, gateway: o.gateway,
-    noValidateModel: o.noValidateModel, noCostGate: o.noCostGate,
-    // v4.3 Task 3 (spec §7.2): attribution ids, forwarded verbatim to runFanout
-    // via run-launch.js so every Stage-1 leg's ledger row carries them.
-    councilRunId: o.runId, councilName: o.councilName,
-    // v4.3 Task 18 (spec §6.2): fallback chains apply to STAGE legs only —
-    // the chair (run-chair.js) and debate legs (run-debate.js) never receive
-    // this, so they never substitute via chains.
-    fallback: o.fallback, catalog: o.catalog,
-  };
-  const launches = [];
-  const seated = []; // parallel to `launches`: what each one was SUPPOSED to seat
-  // Record every sub-wave BEFORE it launches: `amicus abort` cascades over
-  // stages[].waveIds, so an id written after the launch leaves that leg
-  // reachable only by the pid kill (no per-leg abort marker).
-  const record = (waveId) => runState.appendStageWave(o.runDir, 'stage1', waveId);
-  if (o.lenses) {
-    o.models.forEach((m, i) => {
-      const waveId = `${o.runId}-l${i + 1}`;
-      record(waveId);
-      seated.push({ waveId, models: [m] });
-      launches.push(launchers.launchSolo({
-        ...common, model: m, waveId,
-        prompt: briefings.buildLensBriefing({ lens: o.lenses[i], briefing: o.briefing, date: o.date }),
-      }));
-    });
-  } else {
-    const seats = o.models.filter(m => m !== o.critic);
-    if (seats.length > 0) {
-      record(`${o.runId}-s1`);
-      seated.push({ waveId: `${o.runId}-s1`, models: seats.slice() });
-      launches.push(launchers.launchWave({
-        ...common, models: seats, waveId: `${o.runId}-s1`,
-        prompt: briefings.buildSeatBriefing({ briefing: o.briefing, date: o.date }),
-      }));
-    }
-    if (o.critic) {
-      record(`${o.runId}-c1`);
-      seated.push({ waveId: `${o.runId}-c1`, models: [o.critic] });
-      launches.push(launchers.launchSolo({
-        ...common, model: o.critic, waveId: `${o.runId}-c1`,
-        prompt: briefings.buildCriticBriefing({ briefing: o.briefing, date: o.date }),
-      }));
-    }
-  }
-  const results = await Promise.all(launches);
-  let aborted = null;
-  const legs = [];
-  const deadWaves = [];
-  results.forEach((r, i) => {
-    ctx.addWave(r.wave);
-    const abort = isAbortExit(r.exitCode);
-    if (abort) { aborted = r.exitCode; }
-    const got = (r.wave && Array.isArray(r.wave.legs)) ? r.wave.legs : [];
-    legs.push(...got);
-    // ⚠️ Step 10's uncovered half. A wave that died BEFORE its legs (the server
-    // never started; `database is locked`) contributes NOTHING to `legs`, so
-    // deadLegs cannot see it either — which is how run v441plan01 recorded
-    // stage1 'complete' with four seats missing and no trace of them. In lens
-    // mode every seat is its own wave, so a run could lose seats and still exit
-    // 0; the quorum gate only catches the non-lens seat wave. A budget refusal
-    // has its own louder channel already (run-budget.noteBudgetRefusal) and
-    // must not be double-counted here.
-    if (got.length > 0 || abort) { return; }
-    if (r.errorDoc && r.errorDoc.code === 'BUDGET_EXCEEDED') { return; }
-    deadWaves.push({
-      waveId: seated[i].waveId, models: seated[i].models,
-      reason: (r.wave && (r.wave.reason || r.wave.error))
-        || (r.errorDoc && r.errorDoc.message) || 'the wave produced no legs',
-    });
-  });
-  return { aborted, legs, deadWaves };
-}
-
 /** Role of a seat by its input alias. */
 function roleFor(o, alias) {
   if (o.lenses) {
@@ -120,8 +42,15 @@ function roleFor(o, alias) {
 /**
  * Stage 1: independent reviews + findings validation + bounded repair.
  * @returns {Promise<{aborted: number|null, reviews: Array, deadLegs: Array,
- *   deadWaves: Array, degraded: boolean}>} `degraded` covers BOTH ways a seat
- *   can go missing: a leg that ran and died (deadLegs) and a whole sub-wave that
+ *   deadWaves: Array, degraded: boolean, extraRows: Array}>} `extraRows` (v4.7
+ *   D2/E4) is the row-per-launch channel for legs that never became — or
+ *   stopped being — a seat's primary review: one `role:'repair'` row per
+ *   findings-repair solo (error status when the repair itself failed), one
+ *   `role:'superseded'` row per first leg a later attempt replaced (healed OR
+ *   still-dead — either way the first leg stopped being primary), and one
+ *   PRIMARY error row per seat with no surviving review at all.
+ *   `degraded` covers BOTH ways a seat can go missing: a leg that ran and died
+ *   (deadLegs) and a whole sub-wave that
  *   died before its legs existed (deadWaves). A pushed review carries
  *   `findingsUnverified: true` (LC-11) when its findings came from a repair whose
  *   contract could not be checked — the original block was absent or unparseable,
@@ -132,7 +61,7 @@ function roleFor(o, alias) {
 async function runStage1(ctx) {
   const { o } = ctx;
   const { aborted, legs, deadWaves } = await launchStage1(ctx);
-  if (aborted) { return { aborted, reviews: [], deadLegs: [], deadWaves: [], degraded: false }; }
+  if (aborted) { return { aborted, reviews: [], deadLegs: [], deadWaves: [], degraded: false, extraRows: [] }; }
 
   const firstPass = materializeReviews(o.runDir, legs);
   const alive0 = new Set(firstPass.map(m => m.leg));
@@ -147,7 +76,7 @@ async function runStage1(ctx) {
     // abort fixed ~87 lines below ("Must be the post-retry set") — subtract
     // whatever retry.recoveredLegs already healed before this abort landed.
     const healed = new Set(retry.recoveredLegs.map(l => l.modelInput || l.model));
-    return { aborted: retry.aborted, reviews: [], degraded: false,
+    return { aborted: retry.aborted, reviews: [], degraded: false, extraRows: [],
       deadLegs: deadLegs0.filter(l => !healed.has(l.modelInput || l.model)),
       deadWaves: deadWaves.map(w => ({ ...w, models: (w.models || []).filter(m => !healed.has(m)) })).filter(w => w.models.length > 0) };
   }
@@ -185,6 +114,10 @@ async function runStage1(ctx) {
   const stillDeadWaves = [...retry.skippedDeadWaves, ...retry.stillDeadWaves];
 
   const reviews = [];
+  // v4.7 D2/E4: every repair launch is a billed leg of its own, distinct from
+  // the seat's own review leg (m.leg) it is trying to fix — it gets its own
+  // row so its cost is never folded into, or lost from, the review's row.
+  const extraRows = [];
   let repairSeq = 0;
   for (const m of materialized) {
     let conformance = 'clean';
@@ -227,6 +160,7 @@ async function runStage1(ctx) {
         project: o.runDir, waveId, timeout: o.timeout,
         gateway: o.gateway, noValidateModel: o.noValidateModel, noCostGate: o.noCostGate,
         councilRunId: o.runId, councilName: o.councilName,
+        tag: o.tag, // v4.7 F8 D16: rides the same forward as councilRunId/councilName.
         fallback: o.fallback, catalog: o.catalog,
       });
       ctx.addWave(solo.wave);
@@ -236,8 +170,15 @@ async function runStage1(ctx) {
         // short-circuit, so a heal-then-abort run was recording seats as dead
         // that had actually reviewed on retry. Must be the post-retry set,
         // same as the normal-completion return below.
-        return { aborted: solo.exitCode, reviews, deadLegs: stillDeadLegs, deadWaves: stillDeadWaves, degraded: false };
+        // Abort paths add no rows (aborted runs never reach tally) — extraRows
+        // is returned only for shape consistency, never read past this point.
+        return { aborted: solo.exitCode, reviews, deadLegs: stillDeadLegs, deadWaves: stillDeadWaves,
+          degraded: false, extraRows };
       }
+      // Every -p<N> launch gets a row — INCLUDING a repair that failed: the
+      // error status rides naturally off solo.leg (null/'error'-status leg ⇒
+      // buildRunStatsEntry's own never-invent defaults), no special-casing needed.
+      extraRows.push(buildRunStatsEntry({ leg: solo.leg, model: m.modelInput, role: 'repair', wasChair: false }));
       const repaired = (solo.leg && solo.leg.summary) || '';
       if (repaired.trim()) { repairing = repaired; }
       res = validateFindings(repaired);
@@ -285,8 +226,60 @@ async function runStage1(ctx) {
       ...(repairRefused ? { repairRefused } : {}),
     });
   }
+
+  // v4.7 D2/E4 — superseded rows: a leg-origin seat's FIRST leg stops being
+  // primary the moment a retry was actually attempted for it, healed or not
+  // (deadLegs0 × recovered-or-still-dead seats — mirrors the healed-set idiom
+  // above, extended to the still-dead half E4 also requires). A skipped seat
+  // (cost ceiling / unmappable — never got a second leg) keeps NO superseded
+  // row: nothing replaced it. Wave-origin seats never had a first leg at all,
+  // so they can never appear here regardless of healed/dead outcome (E4).
+  const supersededAliases = new Set([
+    ...retry.recoveredLegs.map(l => l.modelInput || l.model),
+    ...retry.stillDeadLegs.map(l => l.modelInput || l.model),
+  ]);
+  for (const dead of deadLegs0) {
+    const alias = dead.modelInput || dead.model;
+    if (supersededAliases.has(alias)) {
+      extraRows.push(buildRunStatsEntry({ leg: dead, model: alias, role: 'superseded', wasChair: false }));
+    }
+  }
+
+  // v4.7 D2/E4 — primary error rows: one per seat with NO surviving review
+  // (every alias still in stillDeadLegs/stillDeadWaves after retry). E5
+  // amended (Task-4 review, owner-ruled): run-retry.js now surfaces the real
+  // retry leg (stillDeadRetryLegs), from the ONE branch it exists in —
+  // retryLegStillDeadNote, a retry leg that came back unusable. Prefer that
+  // REAL leg: status/waveId/usage/duration all real, all from the SAME
+  // attempt (no more pairing a retry's waveId with a different attempt's
+  // status). The other two dead-leg note classes — srcLegStillDeadNote (retry
+  // wave died wholesale, zero legs) and missingLegStillDeadNote (partial
+  // return never named this seat) — never get a real leg, so `leg: null`
+  // (no phantom waveId: one must never appear without a real billed leg).
+  // No 'dead-leg' note at all ⇒ never retried (skipped) ⇒ the original dead
+  // leg is this seat's only, and therefore final, leg.
+  const retryLegByAlias = new Map();
+  for (const leg of retry.stillDeadRetryLegs) { retryLegByAlias.set(leg.modelInput || leg.model, leg); }
+  const attemptedAliases = new Set();
+  for (const n of retry.stillDeadNotes) {
+    if (n.channel === 'dead-leg' && n.data && n.data.seat) { attemptedAliases.add(n.data.seat); }
+  }
+  const deadAliases = new Set([
+    ...stillDeadLegs.map(l => l.modelInput || l.model),
+    ...stillDeadWaves.flatMap(w => w.models || []),
+  ]);
+  for (const alias of deadAliases) {
+    let finalLeg = retryLegByAlias.get(alias);
+    if (!finalLeg) {
+      finalLeg = attemptedAliases.has(alias)
+        ? null                                                              // retried; no leg at all for this seat
+        : (deadLegs0.find(l => (l.modelInput || l.model) === alias) || null); // never retried
+    }
+    extraRows.push(buildRunStatsEntry({ leg: finalLeg, model: alias, role: roleFor(o, alias), wasChair: false }));
+  }
+
   return { aborted: null, reviews, deadLegs: stillDeadLegs, deadWaves: stillDeadWaves,
-    degraded: stillDeadLegs.length > 0 || stillDeadWaves.length > 0 };
+    degraded: stillDeadLegs.length > 0 || stillDeadWaves.length > 0, extraRows };
 }
 
 // runStage2 lives in ./run-stage2.js (300-line gate) but is re-exported here so

package/src/council/run-state.js

@@ -101,13 +101,21 @@ function initCouncilRun(o) {
     // "no debate key" contract and fail the object-typed schema), and with a VALID
     // outcome from the first write so a run killed mid-debate stays schema-valid.
     ...(o.debate ? { debate: { enabled: true, outcome: 'nothing-to-debate' } } : {}),
-    // F9 (v4.5): additive-only — absent (not null) without --template; the MCP
-    // seed (mcp-council-run.js, initRun directly) never sets this in v4.5.
+    // F9 (v4.5): additive-only — absent (not null) without --template. T15-m2
+    // (v4.7): the MCP handler (mcp-council-run.js) now pre-seeds this directly
+    // via its own initRun call when a pack forwards briefing.template; the
+    // spawned CLI child's own seed here still passes o.template: null (no
+    // --template flag crosses that spawn boundary), so this spread omits the
+    // key and mergeRun's shallow merge preserves the parent's pre-seeded value.
     ...(o.template ? { template: o.template } : {}),
     // v4.5 Task 12 (B7/F5): additive-only — absent (not null) without --pack.
     // Preserved across a later MCP-child initRun whose own seed omits it —
     // mergeRun's plain shallow merge never drops a key patch doesn't mention.
     ...(o.pack ? { pack: o.pack } : {}),
+    // v4.7 F8 (D13): additive-only — absent (not null) without --tag. Same
+    // merge-preserve precedent as pack above (mergeRun's shallow merge never
+    // drops a key a later patch doesn't mention).
+    ...(o.tag ? { tag: o.tag } : {}),
     // v4.5 Wave 2 (post-HOLD chip, task-23-report.md Anomaly 1): additive-only
     // — absent (never an empty array) when nothing was dropped. Handler-computed
     // (cli-handlers-council-run.js's resolveBench, via resolveCouncilMembers) so

package/src/council/run.js

@@ -207,9 +207,15 @@ async function runCouncil(options, deps = {}) {
     }
 
     // ---- Chair synthesis (provisional tally feeds the packet) ----
+    // v4.7 D2: two independent extraRows channels — Stage 1's findings-repair
+    // rows and Stage 2's judge-repair rows — concatenate into the ONE array
+    // buildTallyInput appends after the primary review rows (run-assemble.js
+    // docblock). Neither stage invents a second mechanism for the other's kind
+    // of row.
     const mkInput = (chairStats, chairModel) => asm.buildTallyInput({
       runId: o.runId, date: o.date, bench: o.models.slice(), chair: chairModel,
       reviews: s1.reviews, judgeResults: s2.judgeResults, chairStats, claudeReview,
+      extraRows: [...s1.extraRows, ...s2.extraRows],
     });
     const provisionalInput = mkInput(null, o.chair);
     const provisional = tally(provisionalInput);
@@ -231,17 +237,35 @@ async function runCouncil(options, deps = {}) {
       packet, degrade, statsFn, isSignalled: () => signalled,
     });
     if (chairRes.aborted !== null) { return finalize(chairRes.aborted); }
-    const { chairLeg, actualChair, chairText, chairConformance, overallVerdict } = chairRes;
+    const { chairLeg, actualChair, chairText, chairConformance, overallVerdict, chairRows, chairAttempts } = chairRes;
 
     // ---- Final tally (chair row included) + ledger + artifacts ----
     const chairStats = chairLeg ? asm.buildRunStatsEntry({
       leg: chairLeg, model: actualChair, role: 'chair', wasChair: true,
       conformance: chairConformance,
     }) : null;
+    // v4.7 D2: a give-up (no chairLeg) with at least one recorded attempt gets
+    // an explicit error row so the walk's outcome isn't silently absorbed.
+    // Keyed on chairAttempts, NOT chairRows — attempts that die pre-wave (no
+    // money spent) record an outcome but yield no row (errata E3).
+    const giveUpRow = (!chairLeg && chairAttempts && chairAttempts.length)
+      ? asm.buildRunStatsEntry({ leg: null, model: o.chair, role: 'chair', wasChair: false })
+      : null;
     // Built on the (possibly debated) input so the debate's amended claims, replaced
     // adjudications and rebuttal/revote runStats rows all reach the final record.
     const finalInput = { ...debatedInput, meta: { ...debatedInput.meta, chair: actualChair || o.chair } };
-    if (chairStats) { finalInput.runStats = [...(finalInput.runStats || []), chairStats]; }
+    // Item 8, final-review consolidated wave: was three sequential
+    // reassignments (chairStats, then chairRows, then giveUpRow), each
+    // rebuilding finalInput.runStats from scratch — collapsed into the one
+    // spread that was always the net effect. The `|| []` fallbacks were
+    // dead: `runStats` is a real array on every debatedInput
+    // (asm.buildTallyInput always returns one via .map()), never undefined.
+    finalInput.runStats = [
+      ...finalInput.runStats,
+      ...(chairStats ? [chairStats] : []),
+      ...chairRows,
+      ...(giveUpRow ? [giveUpRow] : []),
+    ];
     const record = tally(finalInput);
     if (debateFindings) { decorateRecord(record, debateFindings); }
     if (!o.lenses) {

package/src/council/tally.js

@@ -120,10 +120,14 @@ function tally(input) {
       // travel with it: LC-11's `findingsUnverified` (contract uncheckable) and
       // F1's `repairRefused` (contract checked and broken). Additive, emitted only
       // when set, and the runStats schema declares no additionalProperties, so a
-      // run without either is byte-for-byte unchanged. The append-only LEDGER is
-      // deliberately NOT extended — that is a schema-versioned product decision.
+      // run without either is byte-for-byte unchanged. v4.7 GOA-7 exercised the
+      // ledger's schema-versioned extension slot: `resolvedModel` rides this
+      // allowlist and reaches ledger rows via the ledger's model-keyed join of
+      // primary rows (ledger.js, LEDGER_SCHEMA_VERSION 2).
       ...(r.findingsUnverified ? { findingsUnverified: true } : {}),
       ...(r.repairRefused ? { repairRefused: r.repairRefused } : {}),
+      ...(r.waveId ? { waveId: r.waveId } : {}),
+      ...(r.resolvedModel ? { resolvedModel: r.resolvedModel } : {}),
       status: r.status || 'unknown',
       durationMs: typeof r.durationMs === 'number' ? r.durationMs : null,
       usage: r.usage || null,

package/src/mcp-council-awareness.js

@@ -223,6 +223,7 @@ function listCouncilRuns(project) {
       model: null, agent: 'Plan', createdAt: run.createdAt,
       briefing: sanitizePreview(briefing, 80),
       stage: active ? active.name : null,
+      ...(run.tag ? { tag: run.tag } : {}),
     });
   }
   return out;

package/src/mcp-council-bench.js

@@ -21,6 +21,10 @@
  * spawns the CLI child with an already-expanded `--models` list (never
  * `--council`), so the preset name would otherwise be lost; the caller
  * forwards it via the internal `--council-name` passthrough instead.
+ * Parallel twin: cli-council-run-bench.js's `resolveBench` wraps the same
+ * `resolveCouncilMembers` core with its own XOR rules (CLI failJson docs there,
+ * plain `{error}` strings here) and carries one guard this side lacks. The two
+ * wrappers evolve independently — change a validation rule on one, change both.
  */
 function resolveBenchInput(input) {
   const inputModels = Array.isArray(input.models) ? input.models : [];

package/src/mcp-council-run.js

@@ -94,11 +94,13 @@ async function handleCouncilRunTool(input, project, helpers) {
   // onto input.template above) is the only way one reaches this handler.
   // {{prompt}} = the briefingFile content; the RENDERED text is what lands in
   // briefing.md below (mirrors the CLI's single template-application point).
+  let templateMeta = null;
   if (input.template !== undefined) {
     const { applyTemplate } = require('./template/apply');
     const t = applyTemplate({ templateRef: input.template, prompt: briefing, project });
     if (t.error) { return textResult(t.error.message, true); }
     briefing = t.prompt;
+    templateMeta = t.promptMeta && t.promptMeta.template;
     notices.push(...t.notices);
   }
 
@@ -158,6 +160,10 @@ async function handleCouncilRunTool(input, project, helpers) {
       // v4.5 Wave 2: additive, same preserved-across-the-child's-own-initRun
       // precedent as `pack` above — absent (never []) when nothing dropped.
       ...(droppedMembers.length ? { droppedMembers } : {}),
+      // T15-m2 (v4.7): additive-only — absent (not null) without a pack-forwarded
+      // template. Same preserved-across-the-child's-own-initRun precedent as
+      // `pack`/`droppedMembers` above (run-state.js:104-110).
+      ...(templateMeta ? { template: templateMeta } : {}),
       usage: null, createdAt: new Date().toISOString(),
     });
     runState.writePointer(project, runId, runDir);
@@ -195,6 +201,9 @@ async function handleCouncilRunTool(input, project, helpers) {
   if (input.debate) { args.push('--debate'); }
   if (input.claudeReviewFile) { args.push('--claude-review', path.resolve(project, String(input.claudeReviewFile))); }
   if (input.noCostGate) { args.push('--no-cost-gate'); }
+  // v4.7 F8 (D13): the spawned CLI child's own cli-handlers-council-run.js
+  // stores the tag on the run.json seed (Task 3) — this handler only forwards.
+  if (input.tag) { args.push('--tag', input.tag); }
 
   let child;
   try { child = helpers.spawnFn(args, runDir); } catch (err) {
@@ -275,6 +284,7 @@ const awareness = require('./mcp-council-awareness');
 
 module.exports = {
   handleCouncilRunTool,
+  COUNCIL_PACK_PARAM_MAP,
   buildCouncilStatusPayload: awareness.buildCouncilStatusPayload,
   listCouncilRuns: awareness.listCouncilRuns,
   abortCouncilRun: awareness.abortCouncilRun,

package/src/mcp-server.js

@@ -423,6 +423,10 @@ const handlers = {
     // gate / template pre-render) for parity between the two paths.
     if (packForward.maxCost !== undefined) { args.push('--max-cost', String(packForward.maxCost)); }
     if (packForward.template !== undefined) { args.push('--template', packForward.template); }
+    // v4.7 F8 (D13, errata E-PR3-2): forwarded for the spawn-fallback path
+    // below — DEAD on the shared-server branch (args is never read there);
+    // that branch stamps input.tag directly into its own metadata write instead.
+    if (input.tag) { args.push('--tag', input.tag); }
     args.push('--cwd', cwd);
 
     if (sharedServer.enabled && input.noUi) {
@@ -435,28 +439,30 @@ const handlers = {
         // a fall-through to the spawn-fallback catch must never leak one.
         const inProcessNotices = [...fwd.notices];
         const renderedPrompt = fwd.renderedPrompt !== undefined ? fwd.renderedPrompt : input.prompt;
-        if (packForward.maxCost !== undefined) {
-          // fwd.maxCost is already validated (I2); the ceiling gate itself
-          // stays here (needs resolvedModel/pricing, unavailable to pack-forward.js).
-          const { lookupPricing } = require('./utils/pricing');
-          const { checkBudget, formatBudgetError } = require('./sidecar/budget');
-          const { loadConfig } = require('./utils/config');
-          const cfg = loadConfig() || {};
-          const soloLeg = { modelInput: input.model || resolvedModel, model: resolvedModel, pricing: lookupPricing(resolvedModel) };
-          const budget = checkBudget([soloLeg], {
-            maxCostPerMtok: cfg.maxCostPerMtok, maxCost: fwd.maxCost,
-            promptChars: (renderedPrompt && renderedPrompt.length) || 0,
-          });
-          if (!budget.ok) {
-            const { buildErrorDoc, ERROR_CODES } = require('./utils/error-doc');
-            return {
-              isError: true,
-              content: [{ type: 'text', text: JSON.stringify(buildErrorDoc({
-                code: ERROR_CODES.BUDGET_EXCEEDED, message: 'Error: budget gate refused the run',
-                hint: formatBudgetError(budget),
-              })) }],
-            };
-          }
+        // v4.7 PR6: the gate used to hang off `packForward.maxCost !== undefined`,
+        // so a no-pack MCP start skipped it while the CLI (cli-handlers-run.js:90)
+        // gated unconditionally with a cfg.maxCost fallback. Same guard, both doors.
+        // fwd.maxCost is already validated (I2); the ceiling gate itself
+        // stays here (needs resolvedModel/pricing, unavailable to pack-forward.js).
+        const { lookupPricing } = require('./utils/pricing');
+        const { checkBudget, formatBudgetError } = require('./sidecar/budget');
+        const { loadConfig } = require('./utils/config');
+        const cfg = loadConfig() || {};
+        const soloLeg = { modelInput: input.model || resolvedModel, model: resolvedModel, pricing: lookupPricing(resolvedModel) };
+        const budget = checkBudget([soloLeg], {
+          maxCostPerMtok: cfg.maxCostPerMtok,
+          maxCost: fwd.maxCost !== undefined ? fwd.maxCost : cfg.maxCost,
+          promptChars: (renderedPrompt && renderedPrompt.length) || 0,
+        });
+        if (!budget.ok) {
+          const { buildErrorDoc, ERROR_CODES } = require('./utils/error-doc');
+          return {
+            isError: true,
+            content: [{ type: 'text', text: JSON.stringify(buildErrorDoc({
+              code: ERROR_CODES.BUDGET_EXCEEDED, message: 'Error: budget gate refused the run',
+              hint: formatBudgetError(budget, { kind: 'mcp' }),
+            })) }],
+          };
         }
 
         const { server, client } = await sharedServer.ensureServer();
@@ -500,6 +506,10 @@ const handlers = {
           briefing: renderedPrompt,
           // v4.5 Task 15: additive-only — absent (not null) without a pack.
           ...(packRecord ? { pack: packRecord } : {}),
+          // v4.7 F8 (D13, errata E-PR3-2): THE critical site — this shared-server
+          // branch never spawns a CLI child, so the --tag argv forward above
+          // (dead here) can never reach it. Same additive-only idiom as pack.
+          ...(input.tag ? { tag: input.tag } : {}),
         }, null, 2), { mode: 0o600 });
 
         // Build context from parent conversation (unless --no-context)
@@ -693,6 +703,19 @@ const handlers = {
     // resolved the route in-process above, so surface its notice here.
     const spawnContent = [{ type: 'text', text: body }];
     if (routeResult.notice) { spawnContent.push({ type: 'text', text: routeResult.notice }); }
+    // W1-M6/M7: NOT dead code. This is the same idiom applyPackToMcpInput's
+    // orphan-knob notices always use — amicus_fanout genuinely reaches it today
+    // (FANOUT_PACK_PARAM_MAP has no contextTurns/contextMaxTokens destination;
+    // the fanout handler's own push into waveContent below is covered by
+    // mcp-pack-params.test.js's "notice wording (decision 1b)" test — named,
+    // not line-numbered, because a line citation goes stale the moment anything
+    // is inserted above it, including by its own commit). On THIS solo surface it is
+    // unreachable only while KIND_OPTIONS.solo stays fully covered by
+    // SOLO_PACK_PARAM_MAP destinations + pack-resolve.js's FORWARDABLE_ARG_KEYS
+    // — the invariant tests/pack/mcp-pack-params.test.js guards (the
+    // KIND_OPTIONS.solo round-trip test, mutation-proven against a synthetic
+    // orphaned knob). If that invariant ever breaks, this loop is what turns a
+    // silent drop into a visible notice — never delete it as unreachable.
     for (const n of packNotices) { spawnContent.push({ type: 'text', text: n }); }
     if (isHeadless) {
       spawnContent.push({ type: 'text', text: HEADLESS_START_REMINDER });
@@ -984,37 +1007,11 @@ const handlers = {
     const root = path.join(cwd, '.claude', SESSIONS_DIR);
     if (!fs.existsSync(root)) { return textResult('No amicus sessions found.'); }
 
+    // v4.7 F8 (D14): one enumeration behind both the CLI and MCP list surfaces
+    // — enumerateSessions is the shared core (src/sidecar/read.js).
+    const { enumerateSessions, searchSessions } = require('./sidecar/read');
     const byId = new Map();
-    for (const d of fs.readdirSync(root)) {
-      if (!/^[a-zA-Z0-9_-]{1,64}$/.test(d)) { continue; }
-      if (byId.has(d)) { continue; }
-      const metaPath = path.join(root, d, 'metadata.json');
-      if (!fs.existsSync(metaPath)) { continue; }
-      try {
-        const meta = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
-        const entry = {
-          id: d, model: meta.model, status: meta.status, agent: meta.agent,
-          briefing: sanitizePreview(String(meta.briefing || ''), 80),
-          createdAt: meta.createdAt,
-          mode: meta.mode
-            || (meta.headless === undefined ? undefined : (meta.headless ? 'headless' : 'interactive')),
-        };
-        // Live-progress enrichment for RUNNING sessions only — readProgress
-        // parses conversation.jsonl, so terminal rows stay cheap.
-        if (meta.status === 'running') {
-          try {
-            const p = readProgress(path.join(root, d));
-            entry.phase = deriveStage(meta.status, p.stage);
-            entry.messageCount = p.messages;
-            entry.lastActivityAt = p.lastActivityAt;
-            entry.latestPreview = p.latestPreview;
-          } catch { /* progress optional */ }
-        }
-        byId.set(d, entry);
-      } catch {
-        // Skip unreadable metadata
-      }
-    }
+    for (const row of enumerateSessions(cwd, {})) { byId.set(row.id, row); }
 
     // v4.0 §8: council runs are pointer files in the same sessions root — merge
     // them as first-class rows (type 'council-run') before sorting/filtering.
@@ -1025,8 +1022,34 @@ const handlers = {
     if (input.status && input.status !== 'all') {
       sessions = sessions.filter(s => s.status === input.status);
     }
+    // v4.7 F8 (D15, errata E-PR3-5): search runs on RAW briefing material —
+    // BEFORE the sanitize/enrich pass below truncates row.briefing to an
+    // 80-char preview. Council rows' material is read straight off disk
+    // inside searchSessions; the `briefing` merged onto them here is already
+    // listCouncilRuns' own sanitized preview and is never used for matching.
+    if (input.search) { sessions = searchSessions(sessions, input.search, { project: cwd }); }
     if (sessions.length === 0) { return textResult('No amicus sessions found.'); }
 
+    // Rows are re-grafted here with the EXACT decorations this handler always
+    // applied: sanitized (not raw) briefing, and running-only live-progress
+    // enrichment. Council rows already carry a sanitized briefing from
+    // listCouncilRuns, so they're left alone.
+    for (const row of sessions) {
+      if (row.type === 'council-run') { continue; }
+      row.briefing = sanitizePreview(String(row.briefing || ''), 80);
+      // Live-progress enrichment for RUNNING sessions only — readProgress
+      // parses conversation.jsonl, so terminal rows stay cheap.
+      if (row.status === 'running') {
+        try {
+          const p = readProgress(path.join(root, row.id));
+          row.phase = deriveStage(row.status, p.stage);
+          row.messageCount = p.messages;
+          row.lastActivityAt = p.lastActivityAt;
+          row.latestPreview = p.latestPreview;
+        } catch { /* progress optional */ }
+      }
+    }
+
     return textResult(JSON.stringify(sessions, null, 2));
   },
 
@@ -1237,6 +1260,17 @@ const handlers = {
     if (fwd.error) { return textResult(fwd.error.message + (fwd.error.hint ? `\n${fwd.error.hint}` : ''), true); }
     packNotices.push(...fwd.notices);
 
+    // ⚠️ v4.7 PR7: the zod schema closes the TYPED door; a pack can push the same values through
+    // the other one (validatePack checks option KEY names, never value types). Both entrances
+    // reach the same spawn, so the check lives here, after pack merge, before any wave dir.
+    if (typeof input.prompt !== 'string' || !input.prompt.trim()) {
+      return textResult('Error: prompt must not be empty.', true);
+    }
+    if (input.timeout !== undefined
+        && (typeof input.timeout !== 'number' || !Number.isFinite(input.timeout) || input.timeout <= 0)) {
+      return textResult('Error: timeout must be a positive number of minutes.', true);
+    }
+
     // Resolve a single effective models list (council OR models), validated
     // BEFORE any wave dir / metadata is written so a bad request never strands
     // a pid-less 'running' orphan wave.
@@ -1270,15 +1304,34 @@ const handlers = {
     const waveDir = getSessionDir(cwd, waveId);
 
     let briefingPath;
+    let childPromptPath;
     try {
       fs.mkdirSync(waveDir, { recursive: true, mode: 0o700 });
       briefingPath = path.join(waveDir, 'briefing.md');
+      // ⚠️ W1-M4 (v4.7 PR7): this default is LOAD-BEARING. Omit it and every non-template wave
+      // spawns with `--prompt-file undefined`.
+      childPromptPath = briefingPath;
       // The prompt goes via file: the spawned command line must NOT carry it,
       // or it re-hits the ~32KB Windows argument cap (F4 spec §4.2).
-      fs.writeFileSync(briefingPath, input.prompt, { mode: 0o600 });
+      // ⚠️ W1-M4: briefing.md is the SEARCH CORPUS — src/sidecar/list-search.js reads it verbatim
+      // — and a child that aborts before fanout.js:145 never re-renders it, leaving the wave
+      // permanently unfindable by the text the user actually sees. Write the RENDERED text here
+      // (parity with the amicus_start path at :441/:506) and hand the child the raw input in a
+      // sibling file, so its own later re-render still produces byte-identical output and
+      // promptMeta.template provenance survives.
+      const briefingText = fwd.renderedPrompt !== undefined ? fwd.renderedPrompt : input.prompt;
+      fs.writeFileSync(briefingPath, briefingText, { mode: 0o600 });
+      if (fwd.renderedPrompt !== undefined) {
+        childPromptPath = path.join(waveDir, 'briefing-input.md');
+        fs.writeFileSync(childPromptPath, input.prompt, { mode: 0o600 });
+      }
+      // ⚠️ W1-M4 rider (owner-approved fold): the `briefing` key below must stay — without it the
+      // `list` BRIEFING column renders EMPTY for an aborted MCP wave, since only fanout.js:147
+      // ever wrote a briefing key and an aborted child never reaches it.
       writeFileAtomic(path.join(waveDir, 'metadata.json'), JSON.stringify({
         taskId: waveId, type: 'wave', status: 'running', legs: legIds,
         models: effectiveModels, headless: true, createdAt: new Date().toISOString(),
+        briefing: briefingText.slice(0, 200),
         // v4.5 Task 15: additive-only — absent (not null) without a pack.
         ...(packRecord ? { pack: packRecord } : {}),
       }, null, 2), { mode: 0o600 });
@@ -1292,7 +1345,7 @@ const handlers = {
 
     const args = [
       'fanout', '--models', effectiveModels.join(','),
-      '--prompt-file', briefingPath, '--wave-id', waveId,
+      '--prompt-file', childPromptPath, '--wave-id', waveId,
       '--json', '--client', detectClient(mcpServer), '--cwd', cwd,
     ];
     const agent = input.agent || 'Build';
@@ -1317,6 +1370,12 @@ const handlers = {
     // itself is never forwarded, only the two knobs it resolved to).
     if (packForward.maxCost !== undefined) { args.push('--max-cost', String(packForward.maxCost)); }
     if (packForward.template !== undefined) { args.push('--template', packForward.template); }
+    // v4.7 F8 (D13, errata E-PR3-2): argv-only forward — unlike pack, this does
+    // NOT pre-seed the wave metadata (no single-resolution rule forces it here);
+    // the spawned CLI child's own cli-handlers-fanout.js stores the tag on wave
+    // metadata itself (Task 3), so fanout.js's metaTag inherit arm has no MCP
+    // producer and is defense-in-depth only.
+    if (input.tag) { args.push('--tag', input.tag); }
 
     let child;
     try { child = spawnSidecarProcess(args, waveDir); } catch (err) {
@@ -1506,4 +1565,5 @@ async function startMcpServer() {
 
 module.exports = {
   handlers, startMcpServer, getProjectDir, resolveProjectDir, getClientRoot,
+  FANOUT_PACK_PARAM_MAP, SOLO_PACK_PARAM_MAP,
 };